Hi,
The "security-level" of the interface will control where the traffic can flow through the firewall for as long as the interface has no ACL attached to it. As soon as you attach an ACL to the interface, the ACL will specify what can pass. At that point the "security-level" will have close to no meaning.
There are some situation that will require some additional commands also.
For example situations where the source and destination interface is configured with identical "security-level" or the traffic is entering and leaving the same interface.
- same-security-traffic permit intra-interface = Permits traffic between hosts connected to the same interface
- same-security-traffic permit inter-interface = Permits traffic between hosts connected to 2 different interfaces with identical security-levels.
Notice that in the case where you have 2 interfaces with identical "security-level" values, even if you permit all traffic it still wont pass unless you configure the corresponding command mentioned above.
There is also a command related to VPN which changes the ACL behaviour for traffic entering from a VPN connection to the ASA (past the ASA to some LAN for example)
Default setting for VPN connections is that they bypass the "outside" interface ACL check. To change this behaviour and to control entering VPN traffic on the "outside" interface ACL you can use the command "no sysopt connection permit-vpn"
The default setting is "sysopt connection permit-vpn". It doesnt show in the CLI configuration when its on that default setting. The "no" form of the command does show.
Hopefully the information was helpfull
Feel free to ask more
- Jouni
